What’s Vulnerable › Vulnerabilities
CVE-2019-15892
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-09-03 · updated 2026-06-17
- Weakness: CWE-617
Description
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Affected products
- Debian Linux: 10.0
- varnish-software Varnish Cache: from 6.0.0 before 6.0.4 — fixed in 6.0.4
- Varnish Cache Project Varnish Cache: from 6.1.0 through 6.1.1; from 6.2.0 before 6.2.1 — fixed in 6.2.1
How to fix
Upgrade to a fixed version: varnish-software Varnish Cache 6.0.4; Varnish Cache Project Varnish Cache 6.2.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3/
- https://seclists.org/bugtraq/2019/Sep/5
- https://varnish-cache.org/security/VSV00003.html
- https://www.debian.org/security/2019/dsa-4514
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C/
Get alerted when CVE-2019-15892 or the next vulnerability affects your stack